A verdict years after the attacks

The US Attorney’s Office for the Southern District of New York announced on October 7 that a jury convicted Jonathan Spalletta of computer fraud and money laundering in connection with attacks on Uranium Finance. Prosecutors said two attacks in April 2021 took more than $50 million from the decentralized cryptocurrency exchange. The verdict followed a six-day trial.

The announcement also describes cryptocurrency seized during the investigation, valued at approximately $31 million when seized in February 2025. That valuation has a specific date. It should not be treated as a current portfolio value or as proof that the same amount has already been returned to affected users. A conviction is likewise distinct from the eventual sentence.

The timeline extends beyond the transaction

A blockchain exploit can unfold rapidly while its legal consequences take years. Funds may move across addresses, change form and become connected with assets outside the blockchain. Investigators then need to turn technical traces into evidence that can establish an individual’s responsibility in court.

Our interpretation is that the verdict illustrates the difference between observing an incident and completing an accountability process. Public transaction records can make movements visible, but attribution, custody of evidence and legal proceedings still require separate work. A trace alone does not answer every question a criminal case must address.

Recovery and prevention remain separate

For affected users, the practical priority is usually recovery. A successful prosecution can contribute to that process, but there are further questions about seized assets, competing claims and distribution procedures. The announcement does not mean every depositor has been made whole.

For developers, the case is also a reminder that post-incident enforcement arrives after the damage. Testing, independent review and careful handling of changes to financial code remain central to preventing losses. Those practices cannot be replaced by confidence that investigators may eventually identify a person responsible for an attack.

The wider DeFi lesson is about timescales. Applications can operate continuously and transactions can settle quickly, while remediation and litigation follow a much slower path. Users and teams should assess a product’s safeguards before a crisis, including how it detects problems and communicates with affected people. The Uranium Finance verdict adds a concrete legal outcome to an old exploit without closing every question about restitution or eliminating the need for stronger prevention in future systems.

Source: https://www.justice.gov/usao-sdny/pr/jonathan-spalletta-convicted-defrauding-crypto-exchange-over-50-million-hacks-0